This guide demonstrates how to enable secure RADIUS over TLS (RADSEC) between a Juniper EX4400 switch and a RADIUS backend.

The example uses Ubuntu with FreeRADIUS and Radsecproxy, the same principles apply to other OS distributions.

• Plain UDP RADIUS works but lacks encryption.
• TLS handshake failures due to CN mismatch.
• Authentication fails if Junos‑specific attributes are missing

1. Install prerequisites (example: Ubuntu)

sudo apt update

sudo apt install freeradius freeradius-utils radsecproxy openssl nano

2. Create a local CA

openssl genrsa -out ca.key 4096

openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \

 -out ca.crt -subj "/CN=Radsec-CA"

3. Generate Radsecproxy server certificate

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr \

 -subj "/CN=radsec-server"

openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \

 -CAcreateserial -out server.crt -days 365 -sha256

Copy into radsecproxy directory:

sudo cp server.crt server.key ca.crt /etc/radsecproxy/

sudo chmod 600 /etc/radsecproxy/server.key

4. Configure Radsecprox

/etc/radsecproxy.conf

tls default {

  CACertificateFile /etc/radsecproxy/ca.crt

  CertificateFile  /etc/radsecproxy/server.crt

  CertificateKeyFile /etc/radsecproxy/server.key

}

client ex4400 {

  type tls

  host <EX4400-IP>

  secret radsecsecret

  tls default

}

server freeradius {

  type udp

  host 127.0.0.1

  port 1812

  secret radsecsecret

}

realm default {

  server freeradius

}

Restart service:

sudo systemctl daemon-reload

sudo systemctl restart radsecproxy

5. Configure FreeRADIUS

Add Juniper dictionary:

VENDOR        Juniper        2636
BEGIN-VENDOR  Juniper
ATTRIBUTE     Juniper-Local-User-Name   1   string
ATTRIBUTE     Juniper-Local-User-Id     2   string
END-VENDOR    Juniper

Users file (/etc/freeradius/3.0/users)

andres Cleartext-Password := "aaa123"

    Juniper-Local-User-Name = "andres",

    Juniper-Local-User-Id  = "super-user"

Restart FreeRADIUS:

sudo systemctl restart freeradius

sudo freeradius -X  # debug mode

6. Configure EX4400 PKI

Generate CSR on EX4400:

request security pki generate-key-pair certificate-id ex4400_cert size 2048

request security pki generate-certificate-request certificate-id ex4400_cert subject "CN=EX4400,O=MyOrg,C=US" ip-address <EX4400-IP> filename /var/tmp/ex4400.csr

Sign CSR with CA, copy certs back, and load:

request security pki ca-certificate load filename /var/tmp/ca.crt ca-profile radsec-ca

request security pki local-certificate load certificate-id ex4400_cert filename /var/tmp/ex4400.crt

set security pki ca-profile radsec-ca ca-identity Radsec-CA

set security pki ca-profile radsec-ca revocation-check disable

commit

7. Configure EX4400 RADSEC

set access radsec destination 10 address <Radsecproxy-IP>

set access radsec destination 10 port 2083

set access radsec destination 10 source-address <EX4400-IP>

set access radsec destination 10 tls-certificate ex4400_cert

set access radsec destination 10 tls-peer-name radsec-server

set access radsec destination 10 secret radsecsecret

set access radius-server <Radsecproxy-IP> radsec-destination 10

set system authentication-order radius

set system authentication-order password

8. Verification

show security pki ca-certificate

show access radsec

show log messages | match radius

On Ubuntu:

systemctl status radsecproxy

sudo freeradius -X

Some notes for this scenario, this may change based on each scenario:

• CSR must be written to file, otherwise Junos only prints it.
• Radsecproxy client blocks don’t accept port.
• CN mismatch breaks TLS handshake.
• Junos requires both Juniper attributes in Access‑Accept.
• CA profile must include ca-identity

• RADIUS over TLS (RADSEC) | Junos OS | Juniper Networks
• Configuring RADIUS over TLS (RADSEC) | Junos OS | Juniper Networks